Can VAPT Be Done Remotely? What Needs Access

Anything the tester can reach over the internet, or be given access to, can be tested from anywhere. That covers most of what companies ask for:

• Web applications. The tester signs in with test accounts and works through the application the way a user, or an attacker, would.
• APIs. Requests go straight to the API, sent under each role's login and with no login at all.
• Mobile apps. The tester receives the builds, runs them on test devices and tests the API behind them.
• Public IP addresses and websites. External testing looks at the same surface an outside attacker sees.
• Cloud accounts. A configuration review needs read access to the account, which you grant and can remove afterward.

Internal networks and Active Directory sit behind your firewall, so a tester cannot reach them from the internet. There are three usual ways in:

• A VPN account with the access of an ordinary employee.
• A jump host or virtual machine inside the network that the tester connects to.
• A laptop or device that you place on the network and that connects out to the tester.

All three work from any city. Which one fits depends on your security policy, and the choice belongs in the scope document.

Wireless testing depends on radio range, so the tester has to be within reach of your access points. Some organizations also prefer on-site work for very sensitive environments, or for tests that involve physical devices. These are the exceptions. If a vendor says everything must be done on site, ask why.

Distance does not change the rules, and it makes some of them easier to write down:

• Fixed source addresses. The vendor tells you which IP addresses the testing will come from, so your team can let them through and spot them in its logs.
• Agreed windows. Heavy tests run when you say they may, and usually against a staging copy.
• Written rules of engagement. Scope, off-limits systems, stop conditions and emergency contacts are written down, and each side signs them before work begins.
• Named contacts. Someone on your side can be reached during testing, and someone on the vendor's side owns the engagement.
• Handling of results. Findings can include credentials and personal data, so agree how they are stored, shared and deleted.

• Which parts of the scope will be tested remotely, and which would need access or a visit?
• How will the tester reach internal systems, and who sets that access up?
• Will you receive fixed source addresses before testing starts?
• How is the findings readout done: on a video call, by phone, in person, and in which language?
• If an on-site visit is needed, who pays for travel, and is that written into the proposal?

For a firm in another city, these questions are a good test of how it works. A clear answer to each is a good sign. If you are comparing vendors, our guide to choosing a VAPT company has the wider checklist.